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REMARKS 

Claims 1-27 are currently pending in this application. The Final Office Action mailed 
April 3, 2006 rejected claims 1-20, and 22-27. Claim 2 1 is allowed. Claims 1, 2, 4, 8, 9, 10, 15-16, 
19, and 22-23 have been amended in this response. New claim 28 is added. No claims are 
canceled. No new matter has been added. For the reasons discussed in detail below, Applicants 
submit that the pending claims are patentable over the art of record and respectfully request that the 
Examiner pass this application to issue. 

Rejection of Claims Under 35 U.S.C. S 102 

The Office Action has rejected claims 1-20, and 22-27 under 35 U.S.C. §102(e) as being 
anticipated by U.S. Patent Publication No. 2002/0087883 to Wohlgemuth et al. (hereinafter 
"Wohlgemuth")- Applicants respectfully traverse this rejection. 

As amended, Claim 1 teaches sending a detector to a client process , wherein the detector 
comprises a sequence of different types of computer system calls and detecting, by the server, a 
presence of an unauthorized software behavior on the client based upo n a comparison between the 
response and the detector according to a matching rule. Based on these amendments (underlined 
above) to Claim 1, which are supported by the specification, the claimed invention's sending a 
detector, receiving a response, and the detecting by a server operations clearly are not anticipated by 
the cited prior reference. Examining entries in a history file to see if the past n read requests have 
been sequential, or looking for a file copy pattern can not be read so broadly to anticipate sending a 
sequence of different types of system calls. See Wohlgemuth, paragraphs 0794-0797. 

Moreover, although Wohlgemuth includes discussions about client and servers, 
Wohlgemuth also makes clear that "the invention provides a system that is client based and does not 
rely on the application server to detect or deter piracy attempts ." (Emphasis added) See 
Wohlgemuth, paragraph 16. Thus, Wohlgemuth actually teaches away from a server for use in 
detecting an unauthorized software behavior. Therefore, even read broadly, Wohlgemuth does not 
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disclose or suggest, either expressly or inherently each and every element as set forth in at least 
Claim 1 . Therefore, for at least these reasons, Wohlgemuth does not anticipate nor render obvious, 
at least Claim 1 . 

Amended independent Claim 23 further recites sending a plurality of different detectors, 
wherein each detector . . . comprises a different sequence of different types of system calls . In 
addition, independent Claim 1 5 recites a series of behavioral questions , which comprise a series of 
different types of system calls and an identifier specifying a media associated with the system calls. 
Wohlgemuth does not anticipate sending a plurality (or series) as recited by these claims. Nor does 
Wohlgemuth disclose or suggest, even broadly, including within a series of behavioral questions a 
media identifier. 

Also, independent Claims 9, 15, 16, 22, and 23 have also been amended to clarify that 
the detectors comprise a sequence of different types of system calls. Moreover, Claims 15, 16, and 
23 clearly describe the detection operation occurring at a server. Thus, for at least substantially the 
same reasons discussed above, these independent claims are not anticipated nor rendered obvious 
and are therefore allowable over Wohlgemuth. 

As to Claim 5, the Office Action states that because all data transfers are at least encoded 
in a format conducive of transfer, claim 5 is not distinct. However, encoding in a format for transfer 
even broadly interpreted does not describe obscuring the meaning of the detector, because changing 
a format of data to be conducive of a transfer between a client and server does not disclose or 
suggest obscuring the meaning, merely changing a format. Thus, Wohlgemuth does not disclose or 
suggest all of the limitations of Claim 5, and thus does not anticipate nor render obvious Claim 5. 

In addition, in regard to claims 2-8 and 28, 10-14, 17-20, and 24-27 which are dependent 
on amended independent Claims 1,9, 16, and 23 respectively, they are allowable for at least the 
same reasons discussed above for those independent claims. 
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CONCLUSION 



By the foregoing explanations, Applicants believe that this response has responded fully 
to all of the concerns expressed in the Office Action, and believes that it has placed each of the 
pending claims in condition for immediate allowance. Accordingly, the Examiner is respectfully 
requested to pass this application to issue. Should any further aspects of the application remain 
unresolved, the Examiner is invited to telephone applicant's attorney at the number listed below. 



Dated: June 2, 2006 Respectfully submitted, 
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